Privacy Policy

This Privacy Policy explains how we process personal data when you browse the OpaSailing website, contact us or arrange our services.

Data controller and contact

Nimbo, obrt za usluge u turizmu i turistička agencija, owned by Ozren Blažina, Mirka Jengića 18, Rijeka, Croatia; Croatian business identification number (OIB): 03158904683. For privacy enquiries, contact info@opasailing.eu.

Personal data we process

Depending on how you contact us and the service requested, we process information you provide, such as your name, contact details, enquiry, preferred date, selected service, number of participants and details needed to arrange and deliver the service. We process information required by applicable law for invoicing. When you visit the website, our hosting provider may process technical data such as IP addresses, access times and request logs.

Purposes and legal bases

We process enquiries, booking arrangements and service delivery to take steps at your request before entering into a contract or to perform a contract (GDPR Article 6(1)(b)). Accounting, tax and other statutory records are processed to comply with legal obligations (Article 6(1)(c)). Where applicable, website security, technical operation and the establishment or defence of legal claims are based on legitimate interests (Article 6(1)(f)), subject to a balancing of interests and rights. We do not use enquiry details for unsolicited marketing.

Contact and booking enquiries

Contact by email or WhatsApp is initiated by you. If the website prepares a message, it is sent only when you choose to send it through the selected app. Once sent, the relevant communication provider also processes the information under its own privacy terms.

Recipients

Information may be processed by hosting, email and technical service providers, the communication platform you choose (such as WhatsApp/Meta), accounting service providers and competent authorities where legally required. We do not sell personal data.

Transfers outside the EEA

Depending on the communication platform or technical provider used, personal data may be processed outside the European Economic Area. Where applicable, transfers rely on an adequacy decision or appropriate safeguards, such as standard contractual clauses, in accordance with the GDPR. You may request details of the specific provider and safeguards using our contact address.

Cookies, technical logs and external links

The basic website does not require a user account or online payment. Hosting providers may maintain access and security logs. Links to Google, social media, weather forecasts or other external services take you to their providers’ websites. If analytics, embedded content or optional cookies are used on the published website, we will provide further information and request consent where required. The exact cookies and third-party services depend on the live configuration.

Retention periods

We keep enquiries and related correspondence while handling the enquiry and arranging the service and, where necessary, for the period in which legal claims may be brought or defended. Data that is no longer needed is deleted or anonymised. Invoices and accounting records are kept for the periods required by tax and accounting law. Records of written consumer complaints are kept for one year after receipt. Technical logs are retained only as long as needed for security and according to the hosting configuration.

Your rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction and data portability, and the right to object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting prior lawful processing. Contact info@opasailing.eu to exercise your rights. You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), azop.hr.

Providing data and automated decisions

Information necessary to contact you and arrange a service is needed to respond to your enquiry or perform the contract; without it, we may be unable to arrange the requested service. We do not make automated decisions with legal or similarly significant effects using enquiry data.

Updates

We may update this policy if our operations, services or legal obligations change. The current version will be published on this page.